1. Who we are

Good Sorcery Cloud (the Service, at app.goodsorcery.com) and this website (www.goodsorcery.com) are run by Creative Sorcery LLC, a Nevada limited liability company. For anything about privacy, email support@goodsorcery.com.

This policy doesn't cover copies of Good Sorcery that other people run on their own servers. Whoever runs that copy is responsible for it.

2. Your data and your customers’ data

We handle two kinds of personal data, in two different roles:

Account data, about you as our user. We decide how it's used, so we're the controller.
Customer Data: what your apps send to the Service, which can include personal data about your users. You decide what your apps send and why, so you're the controller and we process it only on your behalf, to provide the Service (a processor, or service provider). If you're one of our customers’ users, please contact that company first. We'll help them with your request.

3. What we collect

Account data

Your name, email address and password (stored only as a secure hash).
Your account, team memberships and settings, such as alert and notification preferences.
Records of emails we send you, such as verification, password reset and alert emails.

Customer Data

Depending on how you configure the Good Sorcery Ruby gem, your apps may send:

error events: the exception, backtrace and nearby lines of code, the request (URL, parameters, headers, session), breadcrumbs, background-job details, environment and release, and user context such as an ID, email or username if your app sends it;
performance data: timings per endpoint and job, and traces of slow requests with database queries stripped of their values and outgoing HTTP calls reduced to method, host and path;
uptime monitors: the URLs you ask us to check and the results of each check.

The gem and the Service remove common secrets (such as passwords and tokens) before storing events, and you can filter out more. Captured data is encrypted at rest.

Technical data

IP addresses and request logs, used for security, rate limiting and preventing abuse.

This website collects nothing beyond what our hosting provider needs to serve pages and protect the site, such as IP addresses in short-lived logs. It uses no cookies and no analytics.

4. How we use it

To provide the Service: show you your data, send the alerts you ask for and run the uptime checks you set up.
To run your account: sign-in, email verification, password resets and messages about the Service.
To keep the Service secure and reliable: rate limiting, abuse prevention and fixing problems.
To meet legal obligations.

Where the law (such as the GDPR) requires a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure service, and legal obligations. We don't sell personal data, share it for advertising, or use Customer Data to train AI models. We only look at Customer Data when you ask us to (for example, for support) or when we need to keep the Service secure.

5. Cookies

When you sign in to the Service, we set one essential cookie to keep you signed in. We don't use advertising, analytics or tracking cookies, so there's nothing to opt out of.

We use a small number of service providers to run the Service, and they handle data only to provide their services to us:

Cloud hosting providers for the servers and databases that store and process data.
Cloudflare for network security and delivery, and to host this website.
Postmark to send emails, such as verification and alert emails.

We may also disclose data if the law requires it, to protect the Service or other people from harm, or to a buyer if the Service is sold or transferred (you'll be told, and this policy will still apply to your data).

7. Where data is stored

Data is stored and processed in the United States and/or the European Union. When data moves between countries, we rely on appropriate safeguards where the law requires them, such as the European Commission's Standard Contractual Clauses.

8. How long we keep it

Customer Data is deleted automatically when it's older than your account's retention period, which the app shows you (for example, 30 days for error events and 1 day for performance data).
Account data is kept while your account is open. If you ask us to close your account, we delete it, along with its Customer Data, within 30 days.
Logs and backups are kept for a limited time and then deleted on a rolling basis.
We keep anything the law requires us to keep for as long as it requires.

9. Security

Data is encrypted in transit (TLS), and captured data is encrypted at rest. Access to production systems is limited to the person who runs the Service. No system is perfectly secure, but if a breach affects your personal data, we'll tell you without undue delay, as the law requires.

10. Your rights

You can ask us to access, correct, delete or export your personal data, or object to or restrict how we use it. Email support@goodsorcery.com from your account's address. We'll reply within 30 days and won't treat you differently for asking.

In the EU, EEA or UK, you also have the right to complain to your local data protection authority.
In California, you have the rights the CCPA gives you, including to know, delete and correct personal information. We don't sell or share personal information as the CCPA defines those terms.

If your request is about Customer Data that one of our customers sent, we'll pass it to that customer, since they decide how it's used.

11. Age limit

You must be at least 18 to use the Service, and we don't knowingly collect personal data from anyone younger. If you believe someone under 18 has given us personal data, email us and we'll delete it.

12. Changes to this policy

We may update this policy, and the date at the top will change when we do. If a change is significant, we'll tell you by email or in the app before it takes effect.

Questions? Email support@goodsorcery.com.